This invention is directed to telecommunications systems having at least partial hardware redundancy and addresses the ability of such a system to isolate a set of the hardware elements to accommodate changes in software control while other in-service hardware elements continue to operate under the control of existing software. This invention is particularly, but not exclusively, suited for use in a telecommunication switching system.
Telecommunications systems which must provide high reliability often employ redundant devices in order to maintain operation should one of the duplicated elements malfunction. A voting type redundancy system employs a plurality of like elements which concurrently perform identical tasks. The outputs from the like elements are compared and if all are the same, the determination is made that all are performing properly. If one of the outputs differs, a predetermined method is employed to select the output to be used. For example, where three like elements are utilized and one of such elements has an output which differs from the other two elements, the element with the differing output would typically be determined as the malfunctioning element and removed from service.
Another type of redundant system utilizes parallel redundant hardware elements wherein like elements are adapted to be interchangeable. In such a system one set of each of the elements is utilized to provide ongoing service while the other redundant set is maintained in a state of readiness (standby) to take over operation should a corresponding active element malfunction. Since like elements are utilized to provide redundancy, the active and corresponding standby elements are interconnected to facilitate a rapid change of state: standby to active; active to standby. Should the active element malfunction, the standby element should preferably have sufficient capacity to assume the total service load. The present invention is especially adapted for utilization in such a parallel hardware redundant system.
In a parallel redundant system in which microprocessor modules are included as redundant elements, each microprocessor module operates under the control of the same software system so that the redundant or standby microprocessor module can quickly assume the role of the active microprocessor module, should the latter malfunction or otherwise need to be taken out of service. Because the active microprocessor module controlled both the active and standby elements, and because of the interconnections between active and standby elements, prior telecommunication systems presented difficulties when new operating software was to be installed. Testing a new telecommunications operating system (software) normally required that the entire telecommunications system cease further processing while the new software was loaded and then executed. Since such systems normally initiated a complete reboot cycle to load the new software, the system remained out of service until the boot cycle was completed including reinitialization of software and hardware parameters and reestablishing communications with the other elements in the system. In a complex telecommunications switching environment, service outages associated with rebooting of the system may last for a substantial number of minutes.
What if the newly booted software in such a system failed to operate properly in the system? Typically, after waiting for the load of the new software and determining that it did not function properly, the system was reloaded with the prior software. Thus, an unsuccessful boot of new software caused a service outage of a substantially longer period of time since the system had to be effectively booted twice. A need exists for an improvement in such systems which will minimize such out-of-service periods.